From 72306a6ff4655c894d50d8ffb1e52d9c626d4713 Mon Sep 17 00:00:00 2001
From: Jerome Mouneyrac <jerome@moodle.com>
Date: Mon, 14 Nov 2011 12:09:40 +0800
Subject: [PATCH 1/2] MDL-28126 webservices : should not able to create token
 if user is deleted,unconfirmed,suspended or guest.

---
 admin/webservice/forms.php  | 6 ++++--
 admin/webservice/tokens.php | 6 ++++++
 lang/en/webservice.php      | 1 +
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/admin/webservice/forms.php b/admin/webservice/forms.php
index 75202284f36..f1908eb6c29 100644
--- a/admin/webservice/forms.php
+++ b/admin/webservice/forms.php
@@ -179,7 +179,7 @@ class external_service_functions_form extends moodleform {
 class web_service_token_form extends moodleform {
 
     function definition() {
-        global $USER, $DB;
+        global $USER, $DB, $CFG;
 
         $mform = $this->_form;
         $data = $this->_customdata;
@@ -188,10 +188,12 @@ class web_service_token_form extends moodleform {
 
         if (empty($data->nouserselection)) {
             //user searchable selector - get all users (admin and guest included)
+            //user must be confirmed, not deleted, not suspended, not guest
             $sql = "SELECT u.id, u.firstname, u.lastname
             FROM {user} u
+            WHERE u.deleted = 0 AND u.confirmed = 1 AND u.suspended = 0 AND u.id != ?
             ORDER BY u.lastname";
-            $users = $DB->get_records_sql($sql, array());
+            $users = $DB->get_records_sql($sql, array($CFG->siteguest));
             $options = array();
             foreach ($users as $userid => $user) {
                 $options[$userid] = $user->firstname . " " . $user->lastname;
diff --git a/admin/webservice/tokens.php b/admin/webservice/tokens.php
index ec06e23185f..cf229ab5446 100644
--- a/admin/webservice/tokens.php
+++ b/admin/webservice/tokens.php
@@ -71,6 +71,12 @@ switch ($action) {
                 }
             }
 
+            //check if the user is deleted. unconfirmed, suspended or guest
+            $user = $DB->get_record('user', array('id' => $data->user));
+            if ($user->id == $CFG->siteguest or $user->deleted or !$user->confirmed or $user->suspended) {
+                throw new moodle_exception('forbiddenwsuser', 'webservice');
+            }
+
             //process the creation
             if (empty($errormsg)) {
                 //TODO improvement: either move this function from externallib.php to webservice/lib.php
diff --git a/lang/en/webservice.php b/lang/en/webservice.php
index 74f84c8f764..aac539124f7 100644
--- a/lang/en/webservice.php
+++ b/lang/en/webservice.php
@@ -92,6 +92,7 @@ $string['externalservices'] = 'External services';
 $string['externalserviceusers'] = 'External service users';
 $string['failedtolog'] = 'Failed to log';
 $string['filenameexist'] = 'File name already exists: {$a}';
+$string['forbiddenwsuser'] = 'Can not create token for a unconfirmed, deleted, suspended or guest user.';
 $string['function'] = 'Function';
 $string['functions'] = 'Functions';
 $string['generalstructure'] = 'General structure';

From b057855440e251106f5cf779622d76f4b1f2ed73 Mon Sep 17 00:00:00 2001
From: Aparup Banerjee <aparup@moodle.com>
Date: Thu, 15 Dec 2011 18:04:42 +0800
Subject: [PATCH 2/2] MDL-28126 webservice : string fixed.

---
 lang/en/webservice.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lang/en/webservice.php b/lang/en/webservice.php
index aac539124f7..d932cd96a8b 100644
--- a/lang/en/webservice.php
+++ b/lang/en/webservice.php
@@ -92,7 +92,7 @@ $string['externalservices'] = 'External services';
 $string['externalserviceusers'] = 'External service users';
 $string['failedtolog'] = 'Failed to log';
 $string['filenameexist'] = 'File name already exists: {$a}';
-$string['forbiddenwsuser'] = 'Can not create token for a unconfirmed, deleted, suspended or guest user.';
+$string['forbiddenwsuser'] = 'Can not create token for an unconfirmed, deleted, suspended or guest user.';
 $string['function'] = 'Function';
 $string['functions'] = 'Functions';
 $string['generalstructure'] = 'General structure';